diff --git a/hw/ip/csrng/rtl/csrng_block_encrypt.sv b/hw/ip/csrng/rtl/csrng_block_encrypt.sv
index ac1d329..f3aac3a 100644
--- a/hw/ip/csrng/rtl/csrng_block_encrypt.sv
+++ b/hw/ip/csrng/rtl/csrng_block_encrypt.sv
@@ -165,7 +165,10 @@
   assign block_encrypt_cmd_o = sfifo_blkenc_cmd;
   assign block_encrypt_id_o = sfifo_blkenc_id;
   assign block_encrypt_v_o = !aes_cipher_core_enable ? sfifo_blkenc_v : cipher_data_out;
-  assign cipher_out_ready = block_encrypt_rdy_i ? aes_pkg::SP2V_HIGH : aes_pkg::SP2V_LOW;
+  assign cipher_out_ready =
+         (!block_encrypt_enable_i) ? aes_pkg::SP2V_HIGH : // flush out AES in halt case
+         block_encrypt_rdy_i ? aes_pkg::SP2V_HIGH :
+         aes_pkg::SP2V_LOW;
 
   assign block_encrypt_sfifo_blkenc_err_o =
          {(sfifo_blkenc_push && sfifo_blkenc_full),
diff --git a/hw/ip/csrng/rtl/csrng_cmd_stage.sv b/hw/ip/csrng/rtl/csrng_cmd_stage.sv
index d899b0e..21f31fd 100644
--- a/hw/ip/csrng/rtl/csrng_cmd_stage.sv
+++ b/hw/ip/csrng/rtl/csrng_cmd_stage.sv
@@ -155,19 +155,26 @@
   assign cmd_len = sfifo_cmd_rdata[7:4];
 
   // capture the length of csrng command
-  assign cmd_len_d = cmd_arb_sop_o ? cmd_len :
+  assign cmd_len_d =
+         (!cs_enable_i) ? '0 :
+         cmd_arb_sop_o ? cmd_len :
          cmd_len_dec ? (cmd_len_q-1) :
          cmd_len_q;
 
   // for gen commands, capture information from the orignal command for use later
-  assign cmd_gen_flag_d = cmd_gen_1st_req ? (sfifo_cmd_rdata[2:0] == GEN) :
+  assign cmd_gen_flag_d =
+         (!cs_enable_i) ? '0 :
+         cmd_gen_1st_req ? (sfifo_cmd_rdata[2:0] == GEN) :
          cmd_gen_flag_q;
 
-  assign cmd_gen_cnt_d = cmd_gen_1st_req ? sfifo_cmd_rdata[30:12] :
+  assign cmd_gen_cnt_d =
+         (!cs_enable_i) ? '0 :
+         cmd_gen_1st_req ? sfifo_cmd_rdata[30:12] :
          cmd_gen_cnt_dec ? (cmd_gen_cnt_q-1) :
          cmd_gen_cnt_q;
 
   assign cmd_gen_cmd_d =
+         (!cs_enable_i) ? '0 :
          cmd_gen_1st_req ? {sfifo_cmd_rdata[11:0]} :
          cmd_gen_cmd_q;
 
@@ -357,10 +364,17 @@
   // ack logic
   //---------------------------------------------------------
 
-  assign cmd_ack_d = cmd_final_ack;
+  assign cmd_ack_d =
+         (!cs_enable_i) ? '0 :
+         cmd_final_ack;
+
   assign cmd_stage_ack_o = cmd_ack_q;
 
-  assign cmd_ack_sts_d = cmd_final_ack ? cmd_ack_sts_i : cmd_ack_sts_q;
+  assign cmd_ack_sts_d =
+         (!cs_enable_i) ? '0 :
+         cmd_final_ack ? cmd_ack_sts_i :
+         cmd_ack_sts_q;
+
   assign cmd_stage_ack_sts_o = cmd_ack_sts_q;
 
 endmodule
diff --git a/hw/ip/csrng/rtl/csrng_core.sv b/hw/ip/csrng/rtl/csrng_core.sv
index dae50eb..84252f3 100644
--- a/hw/ip/csrng/rtl/csrng_core.sv
+++ b/hw/ip/csrng/rtl/csrng_core.sv
@@ -725,7 +725,8 @@
   );
 
   // flops for SW fips status
-  assign genbits_stage_fips_sw_d = !cs_enable ? 1'b0 :
+  assign genbits_stage_fips_sw_d =
+         (!cs_enable) ? 1'b0 :
          (genbits_stage_rdy[NApps-1] && genbits_stage_vld[NApps-1]) ? genbits_stage_fips[NApps-1] :
          genbits_stage_fips_sw_q;
 
@@ -806,16 +807,27 @@
   assign flag0 = acmd_bus[8];
   assign shid = acmd_bus[15:12];
 
-  assign acmd_d = acmd_sop ? acmd_bus[2:0] : acmd_q;
-  assign shid_d = acmd_sop ? shid :
+  assign acmd_d =
+         (!cs_enable) ? '0 :
+         acmd_sop ? acmd_bus[2:0] :
+         acmd_q;
+
+  assign shid_d =
+         (!cs_enable) ? '0 :
+         acmd_sop ? shid :
          state_db_reg_rd_id_pulse ? state_db_reg_rd_id :
          shid_q;
-  assign flag0_d = acmd_sop ? flag0 : flag0_q;
+
+  assign flag0_d =
+         (!cs_enable) ? '0 :
+         acmd_sop ? flag0 :
+         flag0_q;
 
   // sm to process all instantiation requests
   csrng_main_sm u_csrng_main_sm (
     .clk_i(clk_i),
     .rst_ni(rst_ni),
+    .enable_i(cs_enable),
     .acmd_avail_i(acmd_avail),
     .acmd_accept_o(acmd_accept),
     .acmd_hdr_capt_o(acmd_hdr_capt),
@@ -937,7 +949,10 @@
     .state_db_sts_id_o(state_db_sts_id)
   );
 
-  assign statedb_wr_select_d = !statedb_wr_select_q;
+  assign statedb_wr_select_d =
+         (!cs_enable) ? '0 :
+         !statedb_wr_select_q;
+
   assign cmd_blk_select = !statedb_wr_select_q;
   assign gen_blk_select =  statedb_wr_select_q;
 
@@ -998,11 +1013,16 @@
 
 
 
-  assign cmd_req_ccmd_dly_d = acmd_hold;
+  assign cmd_req_ccmd_dly_d =
+         (!cs_enable) ? '0 :
+         acmd_hold;
+
   assign ctr_drbg_cmd_ccmd = cmd_req_ccmd_dly_q;
 
+
   assign cmd_req_dly_d =
-         instant_req || reseed_req || generate_req || update_req || uninstant_req;
+         (!cs_enable) ? '0 :
+         (instant_req || reseed_req || generate_req || update_req || uninstant_req);
 
   assign ctr_drbg_cmd_req = cmd_req_dly_q;
 
@@ -1178,8 +1198,13 @@
   assign      lc_hw_debug_on = (lc_hw_debug_en_out[1] == lc_ctrl_pkg::On);
 
   // flop for better timing
-  assign      lc_hw_debug_not_on_d = lc_hw_debug_not_on;
-  assign      lc_hw_debug_on_d = lc_hw_debug_on;
+  assign      lc_hw_debug_not_on_d =
+              (!cs_enable) ? '0 :
+              lc_hw_debug_not_on;
+
+  assign      lc_hw_debug_on_d =
+              (!cs_enable) ? '0 :
+              lc_hw_debug_on;
 
   //-------------------------------------
   // csrng_block_encrypt instantiation
@@ -1333,7 +1358,10 @@
 
 
   // es to cs halt request to reduce power spikes
-  assign cs_aes_halt_d = ctr_drbg_upd_es_ack && ctr_drbg_gen_es_ack && block_encrypt_quiet;
+  assign cs_aes_halt_d =
+         (!cs_enable) ? '0 :
+         (ctr_drbg_upd_es_ack && ctr_drbg_gen_es_ack && block_encrypt_quiet);
+
   assign cs_aes_halt_o.cs_aes_halt_ack = cs_aes_halt_q;
 
   //--------------------------------------------
diff --git a/hw/ip/csrng/rtl/csrng_ctr_drbg_gen.sv b/hw/ip/csrng/rtl/csrng_ctr_drbg_gen.sv
index 4e03032..690beff 100644
--- a/hw/ip/csrng/rtl/csrng_ctr_drbg_gen.sv
+++ b/hw/ip/csrng/rtl/csrng_ctr_drbg_gen.sv
@@ -284,14 +284,17 @@
     assign v_first = genreq_v + 1;
   end
 
-  assign v_ctr_d = v_ctr_load ? v_first[CtrLen-1:0] :
-                   v_ctr_inc  ? (v_ctr_q + 1) :
-                   v_ctr_q;
+  assign v_ctr_d =
+                  (!ctr_drbg_gen_enable_i) ? '0 :
+                  v_ctr_load ? v_first[CtrLen-1:0] :
+                  v_ctr_inc  ? (v_ctr_q + 1) :
+                  v_ctr_q;
 
   assign v_sized = {v_first[BlkLen-1:CtrLen],v_ctr_q};
 
   // interation counter
   assign interate_ctr_d =
+         (!ctr_drbg_gen_enable_i) ? '0 :
          interate_ctr_done ? '0 :
          interate_ctr_inc ? (interate_ctr_q + 1) :
          interate_ctr_q;
diff --git a/hw/ip/csrng/rtl/csrng_ctr_drbg_upd.sv b/hw/ip/csrng/rtl/csrng_ctr_drbg_upd.sv
index 2610db9..b29033b 100644
--- a/hw/ip/csrng/rtl/csrng_ctr_drbg_upd.sv
+++ b/hw/ip/csrng/rtl/csrng_ctr_drbg_upd.sv
@@ -310,14 +310,17 @@
     assign v_first = sfifo_updreq_v + 1;
   end
 
-  assign v_ctr_d = v_ctr_load ? v_first[CtrLen-1:0] :
-                   v_ctr_inc  ? (v_ctr_q + 1) :
-                   v_ctr_q;
+  assign v_ctr_d =
+                  (!ctr_drbg_upd_enable_i) ? '0 :
+                  v_ctr_load ? v_first[CtrLen-1:0] :
+                  v_ctr_inc  ? (v_ctr_q + 1) :
+                  v_ctr_q;
 
   assign     v_sized = {v_first[BlkLen-1:CtrLen],v_ctr_q};
 
   // interation counter
   assign     interate_ctr_d =
+             (!ctr_drbg_upd_enable_i) ? '0 :
              interate_ctr_done ? '0 :
              interate_ctr_inc ? (interate_ctr_q + 1) :
              interate_ctr_q;
@@ -489,6 +492,7 @@
   assign concat_outblk_shifted_value = {concat_outblk_q, {BlkLen{1'b0}}};
 
   assign concat_outblk_d =
+         (!ctr_drbg_upd_enable_i) ? '0 :
          sfifo_bencack_pop ? {concat_outblk_q[SeedLen-1:BlkLen],sfifo_bencack_v} :
          concat_outblk_shift ? concat_outblk_shifted_value[SeedLen-1:0] :
          concat_outblk_q;
@@ -499,14 +503,22 @@
 
   // concatination counter
   assign concat_ctr_d =
+         (!ctr_drbg_upd_enable_i) ? '0 :
          concat_ctr_done ? '0 :
          concat_ctr_inc ? (concat_ctr_q + 1) :
          concat_ctr_q;
 
   assign concat_ctr_done = (int'(concat_ctr_q) >= (SeedLen/BlkLen));
 
-  assign concat_inst_id_d = sfifo_bencack_pop ? sfifo_bencack_inst_id : concat_inst_id_q;
-  assign concat_ccmd_d = sfifo_bencack_pop ? sfifo_bencack_ccmd : concat_ccmd_q;
+  assign concat_inst_id_d =
+         (!ctr_drbg_upd_enable_i) ? '0 :
+         sfifo_bencack_pop ? sfifo_bencack_inst_id :
+         concat_inst_id_q;
+
+  assign concat_ccmd_d =
+         (!ctr_drbg_upd_enable_i) ? '0 :
+         sfifo_bencack_pop ? sfifo_bencack_ccmd :
+         concat_ccmd_q;
 
   //--------------------------------------------
   // state machine to receive values from block_encrypt
diff --git a/hw/ip/csrng/rtl/csrng_main_sm.sv b/hw/ip/csrng/rtl/csrng_main_sm.sv
index 18f3c17..c8fc938 100644
--- a/hw/ip/csrng/rtl/csrng_main_sm.sv
+++ b/hw/ip/csrng/rtl/csrng_main_sm.sv
@@ -2,15 +2,15 @@
 // Licensed under the Apache License, Version 2.0, see LICENSE for details.
 // SPDX-License-Identifier: Apache-2.0
 //
-// Description: csrng instantiation request state machine module
+// Description: csrng app cmd request state machine module
 //
-//   handles instantiation requests from all requesting interfaces
+//  - handles all app cmd requests from all requesting interfaces
 
 module csrng_main_sm import csrng_pkg::*; (
   input logic                clk_i,
   input logic                rst_ni,
 
-   // ins req interface
+  input logic                enable_i,
   input logic                acmd_avail_i,
   output logic               acmd_accept_o,
   output logic               acmd_hdr_capt_o,
@@ -192,6 +192,10 @@
       end
       default: state_d = Error;
     endcase
+    // Master override for FSM
+    if (!enable_i) begin
+      state_d = Idle;
+    end
   end
 
 endmodule
diff --git a/hw/ip/csrng/rtl/csrng_state_db.sv b/hw/ip/csrng/rtl/csrng_state_db.sv
index 23d74a1..2cd40a2 100644
--- a/hw/ip/csrng/rtl/csrng_state_db.sv
+++ b/hw/ip/csrng/rtl/csrng_state_db.sv
@@ -146,8 +146,8 @@
   assign reg_rd_ptr_inc = state_db_reg_rd_sel_i;
 
   assign reg_rd_ptr_d =
-         !state_db_enable_i ? 4'hf :
-         !state_db_lc_en_i ? 4'hf :
+         (!state_db_enable_i) ? 4'hf :
+         (!state_db_lc_en_i) ? 4'hf :
          (reg_rd_ptr_q == 4'he) ? '0 :
          state_db_reg_rd_id_pulse_i ? '0 :
          reg_rd_ptr_inc ? (reg_rd_ptr_q+1) :
@@ -183,9 +183,17 @@
 
   assign state_db_write = state_db_enable_i && state_db_wr_req_i;
 
-  assign state_db_sts_ack_d = state_db_write;
-  assign state_db_sts_sts_d = state_db_sts;
-  assign state_db_sts_id_d = state_db_id;
+  assign state_db_sts_ack_d =
+         (!state_db_enable_i) ? '0 :
+         state_db_write;
+
+  assign state_db_sts_sts_d =
+         (!state_db_enable_i) ? '0 :
+         state_db_sts;
+
+  assign state_db_sts_id_d =
+         (!state_db_enable_i) ? '0 :
+         state_db_id;
 
   assign state_db_sts_ack_o = state_db_sts_ack_q;
   assign state_db_sts_sts_o = state_db_sts_sts_q;